From de694d7ddc3eb2e25cac4f12561a7e2fb2e7871c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 16 Jul 2026 07:09:40 +0200 Subject: [PATCH] 7.1-stable patches added patches: bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch --- ...creation-if-bpf-lsm-is-uninitialized.patch | 111 ++++++++++++++++++ queue-7.1/series | 1 + 2 files changed, 112 insertions(+) create mode 100644 queue-7.1/bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch diff --git a/queue-7.1/bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch b/queue-7.1/bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch new file mode 100644 index 0000000000..1b284549de --- /dev/null +++ b/queue-7.1/bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch @@ -0,0 +1,111 @@ +From a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4 Mon Sep 17 00:00:00 2001 +From: Matt Bobrowski +Date: Sun, 28 Jun 2026 20:11:03 +0000 +Subject: bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized + +From: Matt Bobrowski + +commit a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4 upstream. + +When CONFIG_BPF_LSM=y is set, BPF inode storage maps +(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However, +if the BPF LSM is not explicitly enabled at boot time (e.g. omitted +from the "lsm=" boot parameter), lsm_prepare() is never executed for +the BPF LSM. + +Consequently, the BPF inode security blob offset +(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at +its default compiled size of 8 bytes instead of being updated to a +valid offset past the reserved struct rcu_head (typically 16 bytes +or more). + +When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE +map, bpf_inode() evaluates inode->i_security + 8. This erroneously +aliases the struct rcu_head.func callback pointer at the beginning +of the inode->i_security blob. During subsequent map element cleanup +or inode destruction, writing NULL to owner_storage clears the queued +RCU callback pointer. When rcu_do_batch() later executes the queued +callback, it attempts an instruction fetch at address 0x0, triggering +an immediate kernel panic. + +Fix this by introducing a global bpf_lsm_initialized boolean flag +marked with __ro_after_init. Set this flag to true inside bpf_lsm_init() +when the LSM framework successfully registers the BPF LSM. Gate map +allocation in inode_storage_map_alloc() on this flag, returning +-EOPNOTSUPP if the BPF LSM is in turn uninitialized. + +This fail-fast approach prevents userspace from allocating inode +storage maps when the supporting BPF LSM infrastructure is absent, +avoiding zombie map states. + +Fixes: 8ea636848aca ("bpf: Implement bpf_local_storage for inodes") +Reported-by: oxsignal +Signed-off-by: Matt Bobrowski +Signed-off-by: Daniel Borkmann +Reviewed-by: Emil Tsalapatis +Reviewed-by: Amery Hung +Link: https://lore.kernel.org/bpf/20260628201103.3624525-1-mattbobrowski@google.com +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/bpf_lsm.h | 4 ++++ + kernel/bpf/bpf_inode_storage.c | 9 +++++++++ + security/bpf/hooks.c | 3 +++ + 3 files changed, 16 insertions(+) + +--- a/include/linux/bpf_lsm.h ++++ b/include/linux/bpf_lsm.h +@@ -14,6 +14,8 @@ + + #ifdef CONFIG_BPF_LSM + ++extern bool bpf_lsm_initialized __ro_after_init; ++ + #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ + RET bpf_lsm_##NAME(__VA_ARGS__); + #include +@@ -55,6 +57,8 @@ bool bpf_lsm_has_d_inode_locked(const st + + #else /* !CONFIG_BPF_LSM */ + ++#define bpf_lsm_initialized false ++ + static inline bool bpf_lsm_is_sleepable_hook(u32 btf_id) + { + return false; +--- a/kernel/bpf/bpf_inode_storage.c ++++ b/kernel/bpf/bpf_inode_storage.c +@@ -178,6 +178,15 @@ static int notsupp_get_next_key(struct b + + static struct bpf_map *inode_storage_map_alloc(union bpf_attr *attr) + { ++ /* ++ * Do not allow allocation of BPF_MAP_TYPE_INODE_STORAGE if the BPF LSM ++ * was not initialized by the LSM framework at boot. Without proper ++ * initialization, the BPF inode security blob offset remains unprepared, ++ * causing bpf_inode() to calculate an invalid memory offset and corrupt ++ * inode->i_security. ++ */ ++ if (!bpf_lsm_initialized) ++ return ERR_PTR(-EOPNOTSUPP); + return bpf_local_storage_map_alloc(attr, &inode_cache); + } + +--- a/security/bpf/hooks.c ++++ b/security/bpf/hooks.c +@@ -7,6 +7,8 @@ + #include + #include + ++bool bpf_lsm_initialized __ro_after_init; ++ + static struct security_hook_list bpf_lsm_hooks[] __ro_after_init = { + #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ + LSM_HOOK_INIT(NAME, bpf_lsm_##NAME), +@@ -24,6 +26,7 @@ static int __init bpf_lsm_init(void) + { + security_add_hooks(bpf_lsm_hooks, ARRAY_SIZE(bpf_lsm_hooks), + &bpf_lsmid); ++ bpf_lsm_initialized = true; + pr_info("LSM support for eBPF active\n"); + return 0; + } diff --git a/queue-7.1/series b/queue-7.1/series index 6a15df52fa..3f686228f6 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -427,3 +427,4 @@ mm-do-file-ownership-checks-with-the-proper-mount-idmap.patch selftests-mm-pagemap_ioctl-use-the-correct-page-size-for-transact_test.patch selftests-mm-fix-ksft_process_madv.sh-test-category.patch nouveau-vmm-fix-another-spt-lpt-race.patch +bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch -- 2.47.3